Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-17052— Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace

Quick assessment

Affected
zephyrproject zephyr
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

驱动程序 中的时间感知 GPIO 系统调用验证处理函数 仅验证了端口设备对象，并将由调用者提供的时间戳和事件计数输出指针直接传递给驱动程序，而未执行 检查。同一文件中的其他处理函数（如 和 ）已经执行了该检查，因此这一遗漏导致一个系统调用缺乏保护。 由于 被声明为 ，在启用 的情况下，任何被授权访问 TGPIO 设备对象的非特权用户态线程，都可以使用任意指针值来调用该函数。位于 中的 仅对引脚索引进行了边界检查，随后无条件地执行 和 ，以用户态调用者选择的地址，在特权级（内核态）执行两次 8 字节的存储操作。 这造

CVSS 7.8 · High EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 2

VendorProduct Version RangeStatus
zephyrproject zephyr 3.5.0< 4.3.2 affected
4.4.0< 4.4.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-17052

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace
Source: CVE Program / CVE List V5
Vulnerability Description
The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated only the port device object and passed the caller-supplied timestamp and event_count output pointers to the driver without a K_SYSCALL_MEMORY_WRITE() check. The other handlers in the same file (z_vrfy_tgpio_port_get_time(), z_vrfy_tgpio_port_get_cycles_per_second()) already performed that check, so the omission left one syscall unguarded. tgpio_pin_read_ts_ec() is declared __syscall, so with CONFIG_USERSPACE=y an unprivileged user-mode thread that has been granted access to the TGPIO device object can invoke it with arbitrary pointer values. tgpio_intel_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_intel.c bounds-checks only the pin index and then unconditionally performs timestamp = ... and event_count = ..., executing two 8-byte stores in supervisor mode at addresses chosen by the user-mode caller. The result is a write-what-where primitive that crosses the userspace/kernel boundary: the target address is fully attacker-chosen and the stored values are the hardware time-capture and event-counter register contents. Corrupting kernel data structures this way can escalate the calling thread to supervisor privilege or crash the system; the device-object permission required is a narrow capability that is not intended to confer any kernel-memory access. The fix adds the two missing K_SYSCALL_MEMORY_WRITE() validations before the driver call. Exposure is narrow in practice. Only builds with CONFIG_USERSPACE=y and CONFIG_TIMEAWARE_GPIO=y compile the affected file, and from v3.6.0 onward the file additionally referenced a relocated header (<zephyr/syscall_handler.h>) and removed Z_SYSCALL_* macros, so such a configuration failed to build until those were repaired after v4.4.0. Downstream trees that locally corrected that breakage, and v3.5.0 builds where it did not exist, are the exposed population.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zephyrproject zephyr 3.5.0 ~ 4.3.2 -

II. Public POCs for CVE-2026-17052

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-17052

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-17052 (1)

Other References for CVE-2026-17052 (1)

Same Patch Batch · zephyrproject · 2026-09-21 · 5 CVEs total

CVE-2026-17051 6.0 MEDIUM Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell leng
CVE-2026-17050 5.7 MEDIUM Double free of the USB host configuration descriptor when device enumeration fails
CVE-2026-15890 5.3 MEDIUM AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread
CVE-2026-17054 5.3 MEDIUM Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's fr

IV. Related Vulnerabilities

Same product: zephyr
Same vendor: zephyrproject
Same weakness: CWE-787